package com.common.mapper;

import com.common.entity.GroupedSyslogData;
import com.common.entity.SyslogNormalData;
import org.apache.ibatis.annotations.Mapper;
import org.apache.ibatis.annotations.Param;
import java.util.Map;
import org.apache.ibatis.annotations.Select;
import java.time.LocalDateTime;
import java.util.List;
@Mapper
public interface SyslogNormalDataMapper {

    /**
     * 动态插入数据 - 使用 Map
     */
    int insertDynamic(@Param("dataMap") Map<String, Object> dataMap);

    /**
     * 动态插入数据 - 使用实体类
     */
    int insertByEntity(SyslogNormalData entity);

    /**
     * 批量插入数据
     */
    int batchInsert(@Param("dataList") java.util.List<Map<String, Object>> dataList);


    /**
     * 统计24小时内分组数据量
     */
    @Select("SELECT count(1) as group_count from ( select  " +
            "to_char(log_time, 'YYYYMMDD') || '_' || " +
            "dest_ip || '_' || " +
            "origin_event_name " +
            "FROM syslog_normal_data " +
            "WHERE log_time >= #{startTime} AND log_time < #{endTime} " +
            "AND   http_resp_codes =200 and   origin_event_type <> ''   and  origin_event_name='访问日志'  AND src_ip NOT IN ('127.0.0.1', '127.0.0.2') " +
            "GROUP BY to_char(log_time, 'YYYYMMDD'),src_ip, dest_ip, origin_event_name  )" )
    Long count24HoursGroupedData(@Param("startTime") LocalDateTime startTime,
                                 @Param("endTime") LocalDateTime endTime);

    /**
     * 分页查询分组数据
     */
    @Select("SELECT " +
            "to_char(log_time, 'YYYYMMDD') as log_date, " +
            "WM_CONCAT(DISTINCT  src_ip)  as  attack_ips, " +
            "origin_event_name, " +
            "MAX(attack_result) as attack_result, " +
            "MIN(log_time) as min_log_time, " +
            "MAX(log_time) as max_log_time, " +
            "COUNT(1) as log_count, " +
            "WM_CONCAT(DISTINCT  dest_ip) as victim_ips, " +
            "WM_CONCAT(DISTINCT http_url) as victim_web_urls, " +
            "WM_CONCAT(DISTINCT device_id) as device_ids, " +
            "WM_CONCAT(DISTINCT id) as origin_log_ids, " +
            "MAX(event_level) as max_event_level, " +
            "MIN(origin_event_type)  AS first_event_type, " +
            "MAX(origin_event_type) as event_type, " +
            "MIN(event_type) as min_event_type, " +
            "WM_CONCAT(DISTINCT src_port) as attack_ports, " +
            "WM_CONCAT(DISTINCT dest_port) as victim_ports, " +
            "WM_CONCAT(DISTINCT http_resp_codes) as http_status_codes, " +
            "WM_CONCAT(DISTINCT payload) as payload_samples, " +
            "WM_CONCAT(DISTINCT http_req_header) as httpReqHeaders, " +
            "WM_CONCAT(DISTINCT http_req_body) as httpReqBodys, " +
            "WM_CONCAT(DISTINCT http_resp_header) as httpRespHeaders, " +
            "WM_CONCAT(DISTINCT http_resp_body) as httpRespBodys, " +
            "LISTAGG(DISTINCT COALESCE(dest_ip, ''), ',') as victim_ips_str " +
            "FROM syslog_normal_data " +
            "WHERE log_time >= #{startTime} AND log_time < #{endTime} " +
            "AND   http_resp_codes =200 and   origin_event_type <> ''   and  origin_event_name='访问日志' AND src_ip NOT IN ('127.0.0.1', '127.0.0.2') " +
            "GROUP BY to_char(log_time, 'YYYYMMDD'), src_ip, dest_ip, origin_event_name  " +
            "ORDER BY log_date, dest_ip, origin_event_name  " +
            "LIMIT #{pageSize} OFFSET #{offset}")
    List<GroupedSyslogData> select24HoursGroupedDataByPage(
            @Param("startTime") LocalDateTime startTime,
            @Param("endTime") LocalDateTime endTime,
            @Param("offset") int offset,
            @Param("pageSize") int pageSize);

    /**
     * 查询指定时间后的所需字段（使用XML映射）
     * 注意：参数类型保持为LocalDateTime，但实际映射时使用类型处理器转换
     */
    List<SyslogNormalData> findRequiredFieldsAfterTime(@Param("startTime") LocalDateTime startTime);

    /**
     * 分页查询所需字段
     */
    List<SyslogNormalData> findRequiredFieldsByPage(
            @Param("startTime") LocalDateTime startTime,
            @Param("limit") int limit,
            @Param("offset") int offset
    );
    @Select("SELECT * FROM syslog_normal_data WHERE created_at >= #{startTime, jdbcType=TIMESTAMP} ORDER BY created_at ASC")
    List<SyslogNormalData> findAfterTime(@Param("startTime") LocalDateTime startTime);

    @Select("SELECT * FROM syslog_normal_data WHERE id = #{id}")
    SyslogNormalData findById(@Param("id") String id);
}